Privacy Policy

1. Who we are

Valawa, a sole proprietorship (eenmanszaak) under Dutch law ("Valawa", "we", "us"), together with any present or future affiliated company, is an affiliate-marketing agency based in the Netherlands. We connect brands with content creators and manage creator partnerships on their behalf. We recognise the importance of your privacy. This policy explains what personal information we collect, how we use it, who we share it with, and the rights you have. By using valawa.nl or our services, you agree to this policy.

Controller and contact details:

• Email: privacy@valawa.nl
• Registered address: De Clercqstraat 50-3, 1052 NH Amsterdam, The Netherlands
• KvK number: 71254706 · VAT number: NL002371641B57

2. What is personal information

Personal information is any information relating to an identified or identifiable person, such as a name, social handle, email address, or location data. We do not treat information that has been anonymised or aggregated, so that it can no longer identify a person, as personal information.

3. Who this is about

This policy is primarily about content creators and influencers we source, evaluate, contact, and collaborate with on behalf of the brands we represent.

4. What personal information we collect

Depending on the stage of the relationship, we may process:

• Identity and contact: your Instagram/TikTok handle, name, and email address.
• Profile and audience: country, language, follower count, engagement rate, average views, category/niche, and a short summary of your public bio.
• Brand mentions and content: public posts, reels, and captions in which you mention or tag a brand we represent, including the post URL/permalink, a reference (URL) to the post's media, the type of signal (mention, tag, discount code, branded link, brand phrase), and the time of the post.
• Partnership and sales data: the affiliate or discount code assigned to you, the number of orders and revenue attributed to that code, the last sale date, and your affiliate link.
• Shipping data (only when we send you product): full name, street, house number, postal code, city, country, and phone number, taken from the email in which you provide your shipping details.
• Communication: the subject lines and thread identifiers of outreach emails we send you, and internal notes about our interaction (for example, that a reply was received).

We do not intentionally collect special categories of data.

5. Instagram and Meta Platform data

Because we monitor brand mentions on behalf of the brands we represent, we use the Instagram Graph API and Meta webhooks. Specifically:

• When you mention or tag a brand we represent in a public post, reel, or comment, Meta notifies us and we retrieve that public media's identifier, caption, permalink, media type, a media URL, and the posting account's username and timestamp.
• We use this only to detect and catalogue published brand content for the relevant brand.
• We do not store Instagram images or videos; media is referenced by URL. A short-lived in-memory cache (up to 24 hours) is used only to render thumbnails inside our internal dashboard.
• Our access to and use of Meta Platform data adheres to the Meta Platform Terms and Developer Policies.

6. Google API data

We use Google Drive, Google Sheets, and Gmail to exchange campaign data with the brands we represent and to manage creator communication. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Where we get it

• Publicly available sources: information you have chosen to make publicly available on social media platforms, such as your public profile, bio, audience statistics, and public posts. Where a brand has authorised us on its own account, we also receive information through the platforms' official APIs (see section 5).
• Affiliate platforms we operate for brands: UpPromote and GoAffPro.
• The brands we represent, through shared spreadsheets (Google Sheets) and files (Google Drive).
• You directly, when you reply to our outreach or provide shipping details.

8. Why we process it, and our legal basis

• To source and evaluate creators for brand campaigns: legitimate interest (art. 6(1)(f) GDPR), matching relevant public creators to brands. Given the public, professional nature of the information involved, we consider that this interest is not overridden by your interests or fundamental rights and freedoms; you can object at any time.
• To contact you about a potential collaboration: legitimate interest. You can object at any time.
• To run an active partnership (send product, track attributed sales, and find and process your published brand content): performance of a contract (art. 6(1)(b)) or legitimate interest.
• Where appropriate, on the basis of your consent (art. 6(1)(a)), which you may withdraw at any time.

9. Automated analysis, including AI

We use automated tools, including large language models from established AI providers, to classify public captions and bios and to extract shipping details from emails you send us. This supports triage and logistics. It does not make legally significant decisions about you without human review. We share with these tools only the specific content needed for the task, and not your full profile.

10. Who we share it with, and when we disclose

We share personal information with service providers who process it on our behalf under appropriate data-processing terms, in the following categories: cloud hosting and infrastructure; productivity, file storage, and email services; the affiliate-marketing platforms we operate for the brands we represent; providers that help us collect publicly available social media information; and the AI providers used for the automated analysis described in section 9. We also share campaign-related information (such as your handle, content, and attributed sales) with the brand you collaborate with.

We do not sell your personal data. As a general rule we do not disclose it to outside parties, except: with your permission; where we are legally required to (statute, regulation, court order, or subpoena); to enforce our terms, prevent or investigate fraud, security breaches, or illegal activity, or protect the rights, property, or safety of others; or in connection with a merger, acquisition, or sale of assets, subject to confidentiality.

11. International transfers

Some of these providers are based outside the EU/EEA. Where that is the case, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses.

12. How we protect it, and how long we keep it

We take appropriate organisational and technical measures to protect the data we hold, and do not keep it longer than needed for the purposes above or as required by law. We make a nightly encrypted backup of our database to Google Drive, retained for approximately 14 days, after which it is deleted.

Indicative retention periods:

• Sourced but not contacted, or rejected candidates: 12 months.
• Active and past partners: for the duration of the partnership and 24 months afterwards, or as long as needed for legal and accounting obligations.
• Instagram content-detection records: 12 months.

When a retention period ends, or on a valid erasure request, we remove the data across our database, our stored files, and let the relevant backups expire.

13. Children

Our services are directed at professional, adult creators. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.

14. Cookies and tracking

valawa.nl does not currently use tracking or analytics cookies and does not set advertising cookies. If this changes, we will update this policy and provide a cookie notice.

15. Your rights

You have the right to access, correct, delete, or port your data, to object to or restrict processing, and to withdraw consent. To exercise any of these, email privacy@valawa.nl. We handle each request manually and respond within the statutory period (one month). You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

16. Requesting deletion of your data

To have your personal data removed, email privacy@valawa.nl with the handle or email address you want deleted. We will remove your data from our database and stored files and let the relevant backups expire (within approximately 14 days). This section also serves as our data-deletion instructions.

17. Contact us

Questions or concerns about this policy: Privacy, c/o Valawa, De Clercqstraat 50-3, 1052 NH Amsterdam, The Netherlands. Email privacy@valawa.nl.

18. Changes to this policy

We may update this policy from time to time. When we do, we revise the "last updated" date at the top. If there are material changes to how we use your personal information, we will post a notice here or on our home page. We encourage you to review this policy when you visit our site.